Borrowing it
Nothing to install: this file belongs to jpicklyk/task-orchestrator. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/jpicklyk/task-orchestrator/main/.claude/skills/api-compat-review/SKILL.mdgit clone --depth 1 https://github.com/jpicklyk/task-orchestratorWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jpicklyk/task-orchestrator/api-compat-review)<a href="https://agentmods.dev/skills/jpicklyk/task-orchestrator/api-compat-review"><img src="https://agentmods.dev/badge/skills/jpicklyk/task-orchestrator/api-compat-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jpicklyk/task-orchestrator/api-compat-review"><img src="https://agentmods.dev/badge/skills/jpicklyk/task-orchestrator/api-compat-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00049 | $0.00564 |
| Opus 5.5 | $0.00020 | $0.00226 |
| Sonnet 5.5 | $0.00010 | $0.00113 |
| Haiku 4.5 | $0.00005 | $0.00056 |
Grade A, and why
api-compat-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 24d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 38 lines — stays where its author put it; the contents beside it link to each section on GitHub.
API Compatibility Review Framework
Assess API changes by surface — the MCP tool surface (dynamically re-discovered by clients) and the REST surface (hardcoded clients) have different compatibility models. Do not apply REST-style breaking-change caution to MCP tools, and do not apply MCP's rename-friendliness to REST.
Step 1: Classify the Change
Determine which surface(s) the change touches:
- MCP tools —
application/tools/tool definitions,parameterSchema, tooldescriptionstrings - REST API —
interfaces/api/v1/routes/,interfaces/api/v1/dto/Dtos.kt,openapi.yaml
A single change (e.g., a domain model field rename) can touch both surfaces independently — assess each.
Step 2: MCP Surface Assessment
LLM clients re-read the tools/list schema every session — there is no persistent client binding to break. A pure parameter rename does NOT require keeping the old name working. Verify instead:
- Every changed param's
parameterSchemakey and its arg-parsing read site stay in sync — no schema-says-X/code-reads-Y drift - ALL first-party callers update in lockstep: plugin skills, hooks (including the
orchestration-contexthook's injected text), auto-memory references, andapi-reference.md. This doc coordination is the real cost of an MCP change, not client breakage. - The tool
descriptionstring accurately reflects the new behavior
Step 3: REST Surface Assessment
HTTP clients hardcode field and param names, so compatibility DOES matter here:
- Response-shape changes are additive (new fields only) where possible
- Renames or removals of existing fields/params have an explicit migration path or version bump — not a silent break
- Note when a surface has effectively zero consumers (e.g., a days-old endpoint) so the reviewer can right-size caution instead of over-indexing on hypothetical clients
-
openapi.yamlis updated for any REST-facing change -
api-rest.mdis updated for any REST-facing change
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 24d ago Changed 2dbe4d8b9f3a
- 1mo ago First seen · 38 lines · 49 tokens per session scan A 5f594ea5bac6
api-compat-review is a skill published in the GitHub repository jpicklyk/task-orchestrator (210 stars, last pushed today), licensed MIT. It adds 49 tokens to every session and 564 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
api-design-reviewer
Use when reviewing API designs for consistency, usability, versioning, error semantics, security, backward compatibility, and developer experience before implementation or release.
md-docs
Manages project documentation: CLAUDE.md, AGENTS.md, README.md, CONTRIBUTING.md, DOCS.md. Use when asked to update, create, or init these context files. Not for general markdown editing.
nodejs-backend
Node.js backend patterns: layered architecture, TypeScript, validation, error handling, security, observability, logging, metrics, deployment. Use when building REST APIs, REST endpoints, middleware, Express/Fastify/Hono/NestJS/Koa servers, tRPC procedures, Bun servers, or server-side TypeScript.
python-services
Python patterns for CLI tools, async parallelism, and backend services. Use when building CLI apps, async/parallel Python, FastAPI services, background jobs, or configuring Python project tooling (uv, ruff, ty).
nodejs-backend
Node.js backend patterns: framework selection, layered architecture, TypeScript, validation, error handling, security, production deployment. Use when building REST APIs, Express/Fastify servers, microservices, or server-side TypeScript.
meta-reviewing-api-reviewing
Backend code review — injection and SSRF, boundary validation, object-level authorization, mass assignment and data exposure, error leakage, N+1 and unbounded queries. Use when a diff touches API routes or handlers, database access, auth middleware, or server code that reads files, starts processes or fetches URLs.